arXiv: 1506.04478v 1 [math.NT] 15Jun2015 


QUICKLY CONSTRUCTING 
CURVES OF GENUS 4 WITH MANY POINTS 


EVERETT W. HOWE 


Abstract. The defect of a curve over a finite field is the difference between 
the number of rational points on the curve and the Weil-Serre bound for the 
curve. We present a construction for producing genus-4 double covers of genus- 
2 curves over finite fields such that the defect of the double cover is not much 
more than the defect of the genus-2 curve. We give an algorithm that uses this 
construction to produce genus-4 curves with small defect. Heuristically, for all 
sufficiently large primes and for almost all prime powers q , the algorithm is 
expected to produce a genus-4 curve over F q with defect at most 4 in time 
5(^/4). 

As part of the analysis of the algorithm, we present a reinterpretation of 
results of Hayashida on the number of genus-2 curves whose Jacobians are 
isomorphic to the square of a given elliptic curve with complex multiplication 
by a maximal order. We show that a category of principal polarizations on 
the square of such an elliptic curve is equivalent to a category of right ideals 
in a certain quaternion order. 


1. Introduction 

For every prime power q and non-negative integer g , we let N q (g) denote the 
maximum number of rational points on a smooth, projective, absolutely irreducible 
curve of genus g over the finite field F 9 . There are many interesting questions one 
might ask about the asymptotic rate of growth of N q (g), but in this paper we will 
focus on the problem of determining, for specific q and g, reasonably tight upper 
and lower bounds on N q (g). In particular, we will consider the case where g = 4. 

The Riemann Hypothese for curves over finite fields, proven in the 1940’s by 
Weil [35-38], shows that for every genus-g curve C over F g we have 

Q + 1 — 2<7 v / g < #C(F 9 ) < q + 1 + 2 g^/q. 

This gives the upper bound N q (g) < q + 1 + 2 g^fq. Serre [29] improved this bound 
for nonsquare q by showing that in fact 

N q {g) < q + 1 + g[2^q\. 

When q > 2g + y/2g + 1, this Weil-Serre upper bound is usually the best upper 
bound we know for N q (g); for certain proper prime powers q > 2g + yj2g + 1 there 
are improvements that can be made (see, for example, Theorem 4, Proposition 5, 
and Corollary 6 of [17]), but for primes in this range no such improvements are 
known. 
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Fifteen years ago, van der Geer and van der Vlugt [10] published a table of the 
best upper and lower bounds on TV, ( 5 ) known at the time, for g < 50 and for q 
ranging over small powers of 2 and 3. They regularly updated their tables and 
posted the updates on van der Geer’s website. Ten years after the first publication 
of these tables, the website manypoints. org was created by van der Geer, Lauter, 
Ritzenthaler, and the author (with technical assistance from Geerit Oomens). The 
manypoints tables include results for many more prime powers q than were in [ 10 ]: 
namely, the primes less than 100, the prime powers p 1 for p < 20 and i < 5, and 
the powers of 2 up to 2 7 . 

The upper bounds presented in the manypoints tables come from a wide variety 
of sources and techniques, as is explained in the introduction to [18]. But lower 
bounds for TV, ( 5 ) are generally obtained by producing examples of curves with 
many points, and for most q and g no-one has done thorough searches for such 
curves. 

For g = 1, the value of N q (g) is determined by a result of Deuring [ 8 ] (see [34, 
Theorem 4.1, p. 536]). For g = 2, the value of N q (g) is given by a result of 
Serre [29-31] (see also [20]). As is explained in [24], there is no easy formula known 
for TV,(3), but for all q in the manypoints tables the value has been computed; the 
introduction to [26] gives a good summary of the techniques that have been used 
to find genus-3 curves attaining the maximum number of points. 

This leads us to the case g = 4. In an earlier paper [16], we obtained new upper 
and lower bounds on TV, (4) for those prime powers q < 100 for which the exact 
value had not been known. The strategy we used for small q sometimes required 
us to search through families of curves to determine whether any members of the 
family had many points. Such strategies do not scale well with the size of the base 
field. 

In this paper, we take a different tack. Instead of performing exhaustive searches 
to try to find curves with point-counts as close as possible to the Weil-Serre bound, 
we will exhibit an efficient algorithm that we expect will produce curves whose 
point-counts are reasonably close to the Weil-Serre bound. In particular, heuristic 
arguments suggest that for all sufficiently large primes and for most prime powers q, 
our Algorithm 6.1 will produce a genus-4 curve over F, whose number of points is 
within 4 of the Weil bound in time 0(g 3 / 4 ). 

In Section 2 we give Algorithm 2.7, which attempts to produce genus-4 curves 
over F, whose Jacobians split (up to a small isogeny) as a product of a given genus- 
2 Jacobian and two elliptic curves from a given list. The algorithm takes as input 
a hyperelliptic curve that can be written y 2 = / 1/2 for two cubic polynomials fi 
and / 2 , and two lists £1 and £2 of elliptic curves that are ‘compatible’ (in a sense 
defined in Section 2) with the polynomials fi and fi- Heuristically, we expect the 
algorithm to succeed with probability proportional to #£i#£ 2 /< 7 , and to run in 
time linear in #£1 and polynomial in log 5 . 

The defect of a genus -5 curve C over F, is the difference between the Weil Serre 
bound and the number of points on C: 

defect C = (q + 1 + g)- #C(F,). 

In Section 3, we explain how Algorithm 2.7 can be used to produce genus-4 covers 
D of genus-2 curves C such that the defect of D is not much larger than the defect 
of C. 
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In Section 4, which may be of independent interest, we reinterpret some results 
of Hayashida having to do with principal polarizations on the square of an elliptic 
curve with complex multiplication. We use these results in Section 5 to show that 
for many primes q there are many genus-2 curves of small defect over F g , and we 
give an algorithm for finding them. 

In Section 6 we put all of the pieces together and present Algorithm 6.1, which, 
as we noted earlier, can be used to quickly find curves of genus 4 with small defect. 
In Section 7 we show how Algorithm 6.1 fares in actual practice. 


Acknowledgments. The author is grateful to John Voight for sharing a draft 
of his forthcoming book [33] and for providing the argument involving quaternion 
algebras that appears in the proof of Theorem 5.8. 


2. A FAMILY OF GENUS-4 CURVES COVERING A GENUS-2 CURVE 

Let fc be a finite field of odd characteristic and let C be a genus-2 curve over k, 
given by a model y 2 = f where / £ k[x) is a separable polynomial of degree 6 . 
Suppose / can be written / = / 1 / 2 , where fi and /2 are cubic polynomials. We 
will associate to this factorization of / a 1-parameter family of genus-4 curves over 
k that are double covers of C and whose Jacobians are isogenous to the product of 
the Jacobian of C with two (variable) elliptic curves. 

For every a £ P 1 (k) with a ^ 00 and /(a) ^ 0, let D a be the curve defined by 
the pair of equations 


w 2 = (x - a)f 1 

£ 2 = (x — a)/ 2 - 

For i = 1 and * = 2 let hi be the polynomial x 3 fi(l/x + a) and let E ai be the 
elliptic curve y 2 = hi, so that E a ^ is isomorphic to the genus-1 curve y 2 = ( x — a)fi . 
To handle the case a = 00 , we let D^ be the curve defined by w 2 = fi,z 2 = fi, 
and for each i we let Eoo^ be the elliptic curve y 2 = fi. If we have call to make the 
dependence of D a on /1 and explicit, we will write D a (fi, f 2 )- 

Theorem 2.1. For each a £ P 1 (fc) such that f(a ) ^ 0 the curve D a has genus 4, 
and there are isogenies 


ip: 3acD a —> (JacC 1 ) x E a: 1 x E ai2 
ip: (JacC) x E a i x E a ^ —> 3acD a 

such that p o ip and ip o p are multiplication-by-2. 

Proof. Let K = k{x), so that the function field of D a is K{w, z ). Since 

/ \ 2 

/ wz 


x — a 


/ 1/2 — /, 
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we see that K(wz/(x — a)) is isomorphic to the function field of C. The diagram of 
Galois field extensions on the left then leads to the diagram of curves on the right: 



The Galois group of D a over P 1 is of course the Klein group V 4 . The images of the 
pullback maps from Jac C, E a ,i, and E a ,2 to JacZ? a are subvarieties of Jac-D 0 that 
have O-dimensional pairwise intersections, because a different subgroup of V 4 acts 
trivially on each of the three subvarieties. Therefore, the three pullback maps piece 
together to give an isogeny ip: (Jac C) x E a p x E a ,2 —> Jac D a , and the pushforwards 
give an isogeny tp in the other direction. On each factor, the composition tp o ip is 
multiplication by 2, so tp o ip = 2. The composition in the other order must then 
also be multiplication by 2 . □ 

Definition 2.2. Let / £ k[x] be a separable cubic. We say that an elliptic curve E 
over k is compatible with / if E is isomorphic to the curve y 2 = cf for some nonzero 
c £ k or if E is isomorphic to the curve y 2 = cx 3 f( 1/x + a ) for some a, c £ k with 

0 . 

Lemma 2.3. An elliptic curve E over k is compatible with a separable cubic f £ 
k[x\ if and only if E and the elliptic curve y 2 = f have the same number of k- 
rational 2-torsion points. 

Proof. Write E as y 2 = g for some separable cubic g. Then E will have the same 
number of rational 2 -torsion points as y 2 = f if and only if the degrees of the 
irreducible factors of / and of g are equal. Likewise, these degrees will be equal if 
and only if there is a linear fractional transformation of Pj. that takes the roots of 
/ to the roots of g. 

Suppose there is such a linear fractional transformation. If it is of the form 
x 1 —^ bx d, then E is isomorphic to y 2 = cf for some c. If it is of the form 
x (bx + d)/(x — a), then E is isomorphic to y 2 = cx 3 f( 1/x + a) for some c. 

Conversely, if E is isomorphic to y 2 = cf or y 2 = cx 3 f(l/x + a), then clearly 
the factorization patterns of / and g are equal, so E and the curve y 2 = f have the 
same number of rational 2 -torsion points. □ 

Notation 2.4. Let / £ k[x] be a separable cubic. We let n(f) denote the number 
of automorphisms of Pj. that permute the roots of /. 

It is easy to see that n(f) is either 3, 2, or 6 , depending on whether / has 0, 1, 
or 3 rational roots. 

Theorem 2.5. Let C and f = / 1/2 be as above. Let S be the set of roots of f 
in k, and let T be the set {j(E )}, where E ranges over all elliptic curves over k 
compatible with f\. The map from P 1 (/c) \S to k that sends a to j(E a p) has image 
contained in T. With at most 5 exceptions, every element of T has exactly n(/i) 
preimages', the exceptions have fewer than n(f\) preimages. 
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Proof. The image of the map lies in T by the very definition of compatibility. 

Let E be an elliptic curve compatible with /i, and suppose g G k\x\ is a cubic 
polynomial such that E is isomorphic to the curve y 2 = g. An element a G P 1 (k)\S 
is a preimage for j(E) if and only if there is an automorphism of P 1 that takes the 
roots of g to the roots of jj and that sends oo to a. The number of automorphisms 
of P 1 taking the roots of g to the roots of jj is equal to n(fi). These automorphisms 
will take oo to distinct elements of P 1 unless E has more than 2 automorphisms; 
that is, unless j = 0 or j = 1728. These distinct elements will all lie in P 1 (fc) \ S , 
unless j is the j-invariant of one of the (at most three) curves y 2 = (x — a)jj, for 
a a root of jj. Thus, all but at most five values of j in T will have exactly n(jj) 
preimages. □ 

Theorem 2.5 says that the j-invariants of the curves E a ,i that we get from a given 
splitting / = / 1/2 are essentially distributed uniformly at random from among the 
j-invariants of the elliptic curves over k compatible with jj. Also, if a given elliptic 
curve is obtained as E a \ for a given splitting / = / 1 / 2 , then its quadratic twist is 
obtained as E a i for the same value of a from the splitting / = (c/j^jj/c), where 
c is a nonsquare in k. These observations lead us to the following heuristic. 

Heuristic 2.6. For a given curve C and polynomials jj, jj as above, we will model 
the pairs ( E a> \,E a , 2 ) as being chosen uniformly at random from among all pairs 
( Ei,E% ) of elliptic curves over k compatible with jj and / 2 , respectively. 

Now let us use the construction implicit in Theorem 2.1 to create an algorithm 
for producing genus-4 double covers D a of a genus-2 curve C, as above, where the 
curves £ Qi 1 and E a ^ lie in a prescribed set of elliptic curves. 

Algorithm 2.7. 

Input: An odd prime power q, coprime cubic polynomials jj and jj in F 9 [x], and 
two lists C\ and £2 of elliptic curves over ¥ q compatible with jj and /j, 
respectively. 

Output: Either the word “failure”, or a value of a € P 1 (F g ) such that jj(a)jj(a) 

0 and such that the elliptic curves £ a , 1 and E a ^ lie in C\ and £ 2 , respec¬ 
tively. 

1. Compute the degree -6 rational function jj G F 9 (£) such that the j-invariant of 
the genus -1 curve y 2 = (2 — a)jj is ji(a). 

2. For every E\ G £1 do: 

(a) Compute the (at most 6 ) values a G P 1 (F 9 ) with ji(a) = j(£’i) and with 
/ 2 (a) ^ 0 . 

(b) For each of these values, check whether E a , 1 lies in C\ and E a ^ lies in £ 2 . 
If so, output a and stop. 

3. Output “failure”. 

Note that if there does exist an a such that E a ,i and £ 0,2 lie in C\ and £ 2 , 
Algorithm 2.7 will find it. Also, it is clear that there are positive constants c± and 
C 2 such that Algorithm 2.7 runs in probabilistic time at most Ci#£i(logg) C2 . 

Heuristic Expectation 2.8. Let q be an odd prime power. Let C\ and £2 be 
two nonempty lists of elliptic curves over F 9 such that all the curves in each list 
have the same number of 2-torsion points, and suppose ffC\ #£2 g 3 / 4 . The 
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probability that Algorithm 2.7 will succeed on a randomly chosen pair (/i,/ 2 ) of 
cubic polynomials in F ? [x] compatible with the curves in C\ and £2 Is approximately 


n{fi)n{f 2 ) 


#£1 #^2 
4 q 


Justification. Using Heuristic 2.6, we view the pairs (Ei ta , E 2<a ) as being chosen 
uniformly at random from among the ordered pairs of elliptic curves compatible 
with /1 and f 2 . There are approximately 4g 2 / (n(fi)n(f 2 )) such pairs of compatible 
curves. The probability that none of the pairs (Ei j£t , E 2 ,a) will lie in the set of 
#£1 ffC 2 pairs we are hoping to find is then given by 


1 - n(/i)n(/ 2 ) 


#£1 #£2 
4 q 2 


k 


where k ss q is the number of elements of P 1 (A:) that are not roots of f\f 2 . Since 
#£1 #£2 -C g 3 / 4 , this probability of failure is approximately 

l-n{/i)n{/») #£ ‘ #£2 . 

4 q 

and the probability of success is as stated in the Expectation. □ 


3. Change in defect 

Recall that the defect of a genus-g curve C over a finite field k is the difference 
between ffC(k) and the Weil-Serre upper bound for genus-g curves over k. In this 
section, we consider using Algorithm 2.7 to produce genus-4 curves whose defect is 
not much more than that of the genus -2 curves that they cover. 

Heuristic Expectation 3.1. Let C be a genus-2 curve over a finite prime field F g 
that can be written in the form y 2 = f\f 2 , where fi and f 2 are irreducible cubic 
polynomials in F g [x]. Let m = [2.y/gJ • If rn is even set k = 1; if m is odd set k = 2. 
Up to powers of log log q, the probability that there is a double cover D of C, of the 
type described in Section 2, such that the defect of D satisfies 

defect D < defect C + 2k 

is approximately g -1 / 2 . 

Justification. We start with some comments about the number of elliptic curves 
with a given small defect. For elliptic curves, the general Weil-Serre bound spe¬ 
cializes into the Hasse bound: The maximal number of points on an elliptic curve 
over F g is q + 1 + m, where m = [ 2 -y/gJ • If m is coprime to g, then there do exist 
elliptic curves over F g with this number of points (see [34, Theorem 4.1, p. 426]). 
More generally, if t is any integer with |t| < |m| and ( t , g) = 1, then the number of 
elliptic curves over F g with g + 1 — t points is equal to the Kronecker class number 
H(t 2 — 4g); see [28, Theorem 4.6, pp. 194-195]. 

Let us consider the number of elliptic curves over F g with g + 1 + m — k points, 
where k is as in the statement of the Expectation. Let t = k — m - , it is easy to check 
that when g is prime, t is coprime to g, so the number of elliptic curves of trace t is 
then equal to the Kronecker class number H{ A) of the discriminant A = t 2 — 4g. 
If the Generalized Riemann Hypothesis is true, then up to factors of log log | A], 
this class number is bounded below and above by -\J\ A|. (For fundamental dis¬ 
criminants, this is [25, Theorem 1, p. 367], and the result for general discriminants 
follows easily.) 
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If we write m = 2y/q — e with 0 < £ < 1, then t = k + e — 2^/q and 

A = (k + e) 2 - 4(A: + e)y/q, 

so certainly 12y/q > |A| > yfq. Therefore, assuming GRH, we expect that up to 
factors of log log q, the number of elliptic curves with defect k is bounded below 
and above by g 1 / 4 . 

Now consider applying Algorithm 2.7 to the irreducible cubics /i and fa, taking 
the lists Ci and £2 to both be the set of elliptic curves of defect k. (Note that the 
value of k is chosen so that the curves of defect k have no rational 2-torsion points, 
so they are compatible with fa and fa.) 

According to Heuristic Expectation 2.8, we expect the algorithm to succeed 
with probability (9/4)(#£i) 2 /g. We have just seen that #£1 ~ g 1 / 4 , up to factors 
of log log g; therefore, we expect success with probability g -1 / 2 , up to factors of 
log log q. If we have success, then the resulting curve D a will satisfy 

d(D a ) = d(C) + d^Eai) + d(E a< 2) = d(C) + 2k. □ 

We expect a similar result for cubic polynomials fa and fa with other factoriza¬ 
tions. We will only explicitly state one. 

Heuristic Expectation 3.2. Let C be a genus-2 curve over a finite prime field F g 
that can be written in the form y 2 = fifa, where fa and fa are cubic polynomials 
in Fg[i] each with exactly one rational root. Let m = \2yfq\. If m is even set 
k = 2\ if m is odd set k = 1. Up to powers of log log q, the probability that there is 
a double cover D of C, of the type described in Section 2, such that the defect d(D) 
of D satisfies 

d(D) < d(C) + 2k 

is approximately g -1 / 2 . 

(Note that, compared to Heuristic Expectation 3.1, the values of k are assigned 
in the opposite way.) 

The justification for this expectation is essentially the same as that for Heuristic 
Expectation 3.1. The main difference is that now we are considering elliptic curves 
with even traces and hence even group orders, but we do not want our sets £1 and 
£2 to include elliptic curves that have all of their 2-torsion defined over the base 
field. Fortunately, it is not hard to see (using, for instance, the theory of isogeny 
volcanoes [9]) that at least half of the curves of trace t do not have all of their 
2-torsion points defined over the base field. 

4. Interlude on work by Hayashida 

In the late 1960s, Hayashida and Nishi studied genus-2 curves lying on products 
of isogenous elliptic curves with complex multiplication. Their initial paper [14] 
studied the general case, and was followed by a paper by Hayashida [13] that con¬ 
sidered the special case of curves lying on E x E, for E with CM by a maximal order. 
In this section we will reinterpret Hayashida’s work in terms of an equivalence of 
categories that is reminiscent of both 

(1) the equivalence of categories between supersingular elliptic curves and rank- 
1 right modules over a maximal order in a quaternion algebra [23], and 
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(2) the bijection between supersingular abelian surfaces (given with an action 
of a maximal order in a quaternion algebra) and “oriented maximal or¬ 
ders” [27, §3], 

First we will define a category of principal polarizations on the square of an 
elliptic curve. Then we will show that this category is equivalent to the category 
of rank-1 right modules over an order in a certain quaternion algebra. Finally, we 
will show that there is an involution on the category such that the orbits of isomor¬ 
phism classes of objects correspond to “good curves” of genus 2 whose (unpolarized) 
Jacobian varieties are isomorphic to the square of the given elliptic curve. 


4.1. The category of principal polarizations on E x E. Let E be an elliptic 
curve over an arbitrary field fc, let O be the ring of (/-rational) endomorphisms of E, 
and suppose that O is isomorphic to the ring of integers of an imaginary quadratic 
field K of discriminant A. Let A be the abelian surface E x E, and note that 
the principal polarizations on A are in bijection with the set of positive definite 
unimodular Hermitian matrices in the matrix ring M2(0). We denote complex 
conjugation (in O and in K) by x i—>■ x. 

Let P K > P' be the involution on M2{0) that sends a matrix P = [“ ^] to 


P' = 


d 

-b 



Let P P* denote the conjugate-transpose involution, and note that P*P' = 
(det P)I, where I is the identity matrix. 

We define a category tPoCs E 2 as follows: The objects of Pots E 2 are positive 
definite unimodular Hermitian matrices in M2(0), that is, principal polarizations 
on E x E. The set of morphisms from one object L to another object M is defined 
to be 

Hom(L, M)={P G M 2 (0): MP = P'L}, 
and composition of morphisms 


Hom(M, N) x Hom(L, M) —> Hom(L, N) 

is given by sending ( Q , P) to QP. It follows that ToCs E 2 is a preadditive category. 
Note that if P is a morphism from L to M, and if we multiply both sides of the 
equality MP = P'L by P*, we find that 

P*MP = (detP)L. 


Since M and L are both positive definite, we see that det P must be a non-negative 
rational integer. 

Let I denote the identity matrix in M2{0). We compute that 


End I = 


a —/3 
B a 


: a, P GO 


Theorem 4.1. The ring End / is an order in a quaternion algebra H = (End/)®Q 
over Q. The algebra H is ramified at infinity, at the prime divisors of A that are 
congruent to 3 modulo 4, and at 2 if A is even but not congruent to 8 modulo 32. 
The reduced discriminant of End / is equal to the discriminant of O. 


Proof. Set 


0 -1 

1 0 


i = 


€ End/, 
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so that i 2 = —1. Let O denote the image of O in M 2 (0) under the twisted 
embedding 

a 0 

ae> _ . 

0 a 

Then End/ = 0[i\. We write elements of 0{i\ as a + i/3, with a, /3 £ O, and we note 
that ai = ia for all a £ O. Likewise, we let K denote the twisted diagonal image 
of K in M 2 (A), and we note that H = K[i\. Clearly H is a quaternion algebra, 
and clearly H is ramified at infinity. 

To find the finite primes that ramify in H, we note that for all a, /3 £ K we have 
(a + i/3) (a — i/ 3) = aa + i/3a — ai/3 — i/3i/3 
= aa + i/3a — iafi — i 2 /3/3 
= N(a) + N(j 3), 

where N denotes the norm from K to Q, so a nonzero a + i/3 has norm 0 if and 
only if N(/3) = —N(a). Setting 7 = /3/a, we see that H is unramified at a prime p 
if and only if there is an element 7 £ K p = K £g) Q p such that 77 = — 1. 

The norm map from K* to Q/ is surjective on units for all primes p that are 
unramified in O, so H is unramified at these primes. We are left to consider the 
primes that are ramified in 0\ let p be such a prime. 

If p = 1 mod 4 then Z p C O p contains an element e whose square is —1 and that 
is fixed by complex conjugation, so p is unramified in H. On the other hand, if 
p = 3 mod 4 then no element of K p has norm — 1, so p is ramified in H. 

This leaves us with the case p = 2. We know that Q 2 /Q 2 2 is a group of order 8 , 
generated by the images of —1, 2, and 3, and we calculate the following table: 


n 

Description 
of Q2 (v^)/Q2 

Is —1 a norm in 

this extension? 

1 

split 

yes 

-1 

ramified 

no 

2 

ramified 

yes 

-2 

ramified 

no 

3 

ramified 

no 

-3 

unramified 

yes 

6 

ramified 

no 

-6 

ramified 

yes 


We see that H is ramified at 2 if and only if the 2-adic extension K 2 of Q 2 is 
isomorphic to Q 2 (y/n) with n = —1, —2, 3, or 6. Summarizing, we see that if H is 
ramified at 2 then so is K , and if K is ramified at 2 then so is H, unless the 2-adic 
extension is isomorphic to Q2(v^) with n = 2 or n = —6. This can be summarized 
even more briefly: if A is even, then H is ramified at 2 unless A = 8 mod 32. 

Finally, a direct computation shows that the trace dual of 0[i\ is A[i\, where A 
is the trace dual of O. It follows that the reduced discriminant of 0{i\ is A. □ 

4.2. An equivalence of categories. We define a functor F from the category 
Fob E 2 to the category of rank-1 projective right O^J-modules as follows: If L is a 
positive definite unimodular matrix, we take F{L) to be the right (Endl)-module 
Hom(/, L). If P is a morphism from L to M, we take F(P) to be the morphism 
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of right 0[z]-modules that takes an element Q of F(L) = Hom(7, L) to the element 
PQ of F(M) = Horn (7, M). 

Theorem 4.2. Suppose A ^ 0 mod 8. Then the functor F is an equivalence of 
categories. 


Proof. Before we begin the proof proper, we describe the module Hom(7, L) a 
little more concretely. Suppose that L = ^ a 


is an element of M 2 (0). Let 


S = 


k a 
0 1 


so that S*S = (det S)L. By definition, 

Hom(7, L) = {P £ M 2 (0): LP = P'}. 


The condition LP = P' translates into S*SP = (det S)P', which is equivalent to 
SP = (. SP)'. Since the set of elements x £ M 2 {K) satisfying x — x' is exactly K[i], 
this means that 

Hom(7, L) = M 2 (0) D S'" 1 • K[i], 
where the intersection takes place in M 2 (K). 

As a right 0[z]-module, Hom(7, L) is isomorphic to 


S Hom(7, L) 


u + iv € K[i\ : 


1 —a 
0 k 


u —v 


£ kM 2 (0) 


It is easy to check that this set is generated (as a right 0-module) by the two 
elements k and a + i. Thus, Hom(7, L) is isomorphic as a right 0[z]-module to the 
ideal (7, a + i). In particular, Hom(7,L) is a projective rank-1 0[z]-module. 

To prove that F gives an equivalence of categories, it suffices to show that F is 
fully faithful and that F is surjective on isomorphism classes of objects. 

Surjectivity: Section 3 of [13] (see in particular the final paragraph) shows that 
there is a bijection between right 0[z]-ideals and what Hayashida calls “proper 
classes” of unimodular Hermitian matrices. One can check that two unimodular 
Hermitian matrices are in the same proper class (according to Hayashida’s defini¬ 
tion [13, p. 31]) if and only if there are isomorphic in the category tPoLs E 2 . Thus, 
Hayashida already gives us a bijection between isomorphism classes of objects in 
tPoCs E 2 and equivalence classes of right C>[z]-ideals. 

Full fidelity: Suppose L and M are two objects in Tots E 2 , say 


L = 

'k 

a 

and 

M = 

m 

p 


a 

i 



3 

n 

S = 

'k 

a 

and 

T = 

m 

p 


0 

1 



0 

i 


so that S*S = (detAjL and T*T = (detT)M. By definition, Hom(L,A7) is equal 
to the set of P £ M 2 {0) with MP = P'L, and a calculation shows that this last 
condition is equivalent to TPS -1 = (TPS' -1 )'. Thus, 

Hom(L, M) = M 2 {0) l~l T -1 • K[i\ ■ S. 


If P is an element of Hom(i, A7), then the homomorphism F(P) from 

Hom(7, L) = M 2 {0) D S~ l ■ K[i\ 


to 

Hom(7, M) = M 2 {0) HP 1 ■ K[i] 
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is simply multiplication on the left by P. 

Now, every morphism from a right 0['<]-ideal to another right 0[i]-ideal is ob¬ 
tained from left multiplication by an element of K\i\. In particular, every element 
of Horn (SF(L),TF(M)) is given by left multiplication by an element of K[i], so 
every element of Horn (F(L),F(M) is given by left multiplication by an element P 
of T _1 • K[i] ■ S. Multiplication by P will take the lattice M2(0) C S’ -1 • K[i\ to the 
lattice M 2 (O) C T~ 1 -K[i\ if and only if P lies in M 2 (O). Thus, Horn(P(L),P(M)) 
is also isomorphic to M2(0) D T -1 ■ K[i] ■ S, and the functor F gives one such iso¬ 
morphism. □ 

4.3. An involution on the category of principal polarizations. Set 

s= l €M 2 (0), 

so that s 2 = I and s' = — s. We define an involution on Pols E 2 as follows: 
If L is an object of Pols E 2 we set L = sLs , and we define an isomorphism 
Hom(L,M) —> Hom(L,M) by sending P £ Horn (L,M) to P = sPs. In this 
subsection we will define a second category, Curves E 2 , whose isomorphism classes 
of objects correspond to orbits of isomorphism classes of objects of Tots E 2 under 
this involution. 

The objects of Curves E 2 are the same as the objects of Pols E 2 : namely, positive 
definite unimodular Hermitian matrices in M 2 (0), which we can also consider to 
be principal polarizations on E x E. The set of morphisms from one object L to 
another object M is defined to be 

Hom(L, M) = {P £ M 2 (0): MP = ±P'L }; 

note the plus-or-minus sign in the definition. As in Pols E 2 , composition of mor¬ 
phisms 

Hom(M, N) x Hom(L, M) —> Hom(L, N) 

is given by sending ( Q,P ) to QP. Unlike PolsE 2 , the category Curves E 2 is not 
preadditive, because if P\ is an endomorphism of L that takes the plus sign in the 
definition, and if P 2 is an endomorphism that takes the minus sign, then in general 
Pi + P 2 will not be an endomorphism of L. 

Note that if P is a morphism from L to M, and if we multiply both sides of the 
equality MP = ±P'L by P*, we find that 

P*MP = ±(detP)L. 

Since M and L are both positive definite, we see that det P is a rational integer. 
Thus, a morphism from L to M is an element P of M 2 (0) such that det.P is a 
rational integer and such that 

P*MP = \det P\L. 

Recall that a good curve of genus 2 is either a nonsingular curve of genus 2 or 
a pair of elliptic curves crossing transversely at a point. (Over a field that is not 
algebraically closed, the two elliptic curves may be a Galois conjugate pair of curves 
defined over a quadratic extension.) For the rest of this section, we will simply write 
good curve when we mean a good curve of genus 2. If C is a good curve consisting 
of two elliptic curves crossing transversely at a point, its Jacobian is the product of 
the two elliptic curves, together with the product principal polarization. Torelli’s 
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theorem in genus 2 says that the Jacobian map from the set of good curves to the 
set of principally-polarized abelian surfaces is a bijection. 

Suppose C i and C 2 are good curves whose Jacobians are isomorphic to E 2 (as 
unpolarized surfaces). Let ipi and ip 2 be isomorphisms from JacCi and JacC 2 
to E 2 , let Ai and A 2 be the canonical polarizations on JacCi and JacC 2 , let p, be 
the product principal polarization on E 2 , and for each i let Li = /U _1 <^i*Aj, so that 
Li £ M2(0) is a positive definite unimodular Hermitian form. 

Note that the good curves C\ and C 2 are isomorphic to one another if and only 
if their polarized Jacobians are isomorphic to one another, which will be the case 
if and only if there is an invertible P £ M2(0) such that P*L\P = L 2 . If the 
discriminant A of O is anything other than —3 or —4, then such an invertible P 
must have determinant ±1, in which case P also gives an isomorphism between L\ 
and L 2 in the category Curves E 2 . Thus, when |A| > 4, the objects of Curves E 2 
can be viewed as the good curves over k whose Jacobians are isomorphic to E 2 . 


5. Genus-2 curves with small defect 


Given Heuristic Expectations 3.1 and 3.2, our strategy for producing genus-4 
curves with small defect is clear: We should try to produce a large number of 
small-defect curves of genus 2 that can be written y 2 = / 1/2 for cubic polynomials 
fi and / 2 , and then apply Algorithm 2.7 to all of the pairs (/ 1 , / 2 ), taking the sets 
C\ and £2 to be the elliptic curves of small defect. As long as we have significantly 
more that q 1 / 2 curves of genus 2 to work with, we should find a small-defect curve 
of genus 4 in this way. 

In this section, we show that in some cases we can prove that there are sufficiently 
many genus -2 curves of small defect, and we have an efficient way of producing them. 

Theorem 5.1. Let q be a prime power and let t be an integer, coprime to q, with 
|t| < ■ Let A = t 2 — 4q, write A = Ao F 2 for a fundamental discriminant Ao, 

and let r be the number of prime factors of Aq. If |Ao| > 4 then the number of 
genus-2 curves over F g with Weil polynomial ( x 2 — tx + q) 2 is at least 

h(A 0 )ip(\A 0 \) 

12 • 2 r 

where ip is the Euler ip-function. 

In fact, in the case where |A| is prime, we have an exact value for the number 
of genus-2 curves with the specified Weil polynomial. 


Theorem 5.2. Let q be a prime power and let t be an integer, coprime to q, with 
|t| < . Let A = t 2 — 4q. If |A| is a prime greater than 3, then the number 

of genus-2 curves over F g with Weil polynomial ( x 2 — tx + q ) 2 is exactly Nh(A), 
where 


( 1 ) 



h{ A) - 1 
2 


Proof of Theorems 5.1 and 5.2. Suppose we are in the situation of Theorem 5.1, 
and let E be an elliptic curve over F g with trace t and with endomorphism ring of 
discriminant Ao, that is, with endomorphism ring a maximal order. Hayashida [13, 
pp. 42-43] gives an exact formula for the number N of nonsingular genus-2 curves 
whose Jacobians are isomorphic (as unpolarized varieties) to the product E x E\ 
he works over the complex numbers, but the argument works for ordinary elliptic 
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curves over finite fields as well . 1 The number N depends on A in a somewhat 
complicated way, but for our purposes we need only note two facts. First, if | Ao| >4 
then N is at least <p(|Ao|)/24, and second, when | A| is greater than 3 and is prime 
(and hence 3 mod 8 ), Hayashida’s formula for N reduces to (1). 

How many abelian surfaces with Weil polynomial ( x 2 — tx + q) 2 can be written 
as E x E, where E has CM by a maximal order? The set of E with CM by Ao 
is in bijection with the class group of Ao, and two such curves E\ and E 2 have 
isomorphic squares if and only if their associated ideal classes have squares that are 
equal. Thus, the set of surfaces of the form E x E where E has CM by Ao is in 
bijection with the set of squares in the class group. Since the 2-rank of the class 
group is r — 1, there are h( Ao)/2 r ’~ 1 such surfaces. Combining this equality with 
the lower bound on N from the proceeding paragraph gives us the lower bound of 
Theorem 5.1. 

When —A is prime we have Ao = A, and every element of the class group 
is a square. Thus, there are exactly Nh( A) curves over F g with the given Weil 
polynomial, as claimed in Theorem 5.2. □ 

Theorems 5.1 and 5.2 include a requirement that t be coprime to q. We will 
see similar conditions frequently enough in what follows to justify the following 
definition. 

Definition 5.3. Let d be a non-negative integer. A prime power q is d-exceptional 
if there are no elliptic curves of defect d over the finite field F g ; otherwise, q is 
d-unexceptional. 

For positive d and for q that are not too small, it is easy to tell when q is 
d-exceptional. 

Proposition 5.4. Let d be a positive integer and let q be a prime power with 
q > 56d 2 . Then q is d-exceptional if and only if q is not coprime to L2i/qJ — d. 

Proof. Let t = |_2 v^J — d. If q > 56d 2 then t certainly lies in the Weil interval, 
and according to [28, Theorem 4.2, p. 193] there will exist elliptic curves over F g 
with trace t if and only if either t is coprime to q or t is not coprime to q and lies 
in a short list of possible values. The defects associated to these possible values 
are 0 (if q is a square) and possibly several other values, all of which are at least 
(2 — — 1. Since q > 56d 2 , if q is d-unexceptional then d is one of these values 

and we have 

d > (2 — V3)^/q — 1 > (2 — v/3) \/56 d — 1 > 2d - 1, 

which is impossible. Therefore, there are elliptic curves over F g of defect d if and 
only if Lv^J — d is coprime to q. □ 

Corollary 5.5. Let d be a positive integer and let q be a prime power with q > 56d 2 . 
If q is prime, or if q is a square that is coprime to d, then q is d-unexceptional. □ 

Heuristic.ally, for every fixed d > 0 one expects the number of d-exceptional 
primes powers less than x to grow like a constant times logic. 


1 Note that there is a misprint on page 43 of [13]: The term (1/4)(1 — (—l))( m2 W 8 in the 

second line should be (1/4)(1 — (—l)( m2 ~ 1 P 8 )h. 
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In Theorem 5.1, if q is coprime to t and if the conductor F is equal to 1, then 
the theorem leads to a lower bound of 

h{A)if(\A\) h{A)<p(\A\) 

12 -2 r - 12 • D(|A|) 

for the number of genus-2 curves with the specihed Weil polynomial, where T> is 
the divisor function. We know that there is a constant c such that <p(n) > cn/ logn 
for all n (see [12, Theorem 328, p. 267]), and we know that under the GRH we 
have h( A) > d \J |A|/ log log |A| for some constant d (see [25, Theorem 1, p. 367]). 
Furthermore, the divisor function T>{n) has average order logn and normal order 
(logn) log2 (see [12, Theorem 319, p. 264] and [12, Theorem 432, p. 359]). In the 
case where we are considering the squares of isogeny classes of elliptic curves with 
small positive defect d, we have A « d^fq, and we are led to suggest the following 
heuristic. 

Heuristic 5.6. For every prime q and integer d > 0, let M q ^ be the number of 
genus-2 curves over F g with Jacobians isogenous to the square of an elliptic curve 
with defect d. For each fixed d > 0, we will model M q ^ as growing like q 3 / 4 , up to 
logarithmic factors, as q ranges over the prime powers that are d-unexceptional. 

Note that when d = 0we would still expect M q ( j to be 0(<7 3 / 4 ), but we do not 
expect a lower bound of the same shape — indeed, if q is a prime of the form n 2 +1, 
then M^o = 0. 

Heuristic 5.6 suggests that there are relatively many genus-2 curves with small 
defect. For the purpose of constructing examples, though, we need more than a 
simple statement of existence; we would like a way of producing these curves of 
small defect. Here is an algorithm that in certain cases is guaranteed to do so. 

Algorithm 5.7. 

Input: An odd prime power q and a list C of elliptic curves over F g with defect 
at most d. 

Output: A list of genus-2 curves over F g with defect at most 2d. 

1. Initialize S to be the empty list. 

2. For every pair of elliptic curves Ei,E 2 in A: 

(a) Use Algorithm 5.1 (pp. 183-184) of [5] to compute the set of genus-2 curves 
over F q whose Jacobians are (2, 2)-isogenous to E\ x E 2 . 

(b) Append to S all of the resulting curves that are not already isomorphic to 
a curve in S. 

3. Set i = 1. 

4. Repeat the following until i > ffS: 

(a) Let C be the i-th element of S. 

(b) Compute all of the genus-2 curves over F g that are Richelot isogenous to C, 
using the formulas from [6, §4]. 

(c) Append to S all of the resulting curves that are not already isomorphic to 
a curve in S. 

(d) Increment i. 

5. Output S. 




CURVES OF GENUS 4 WITH MANY POINTS 


15 


Theorem 5.8. Let q be an odd prime power, let d > 0 be an integer, let t = 
L2^/?J — d, and suppose t is odd, positive, and coprime to q. Let A = t 2 — 4 q, and 
write A = Ao F 2 for a fundamental discriminant Ao. Let S be the list produced 
by Algorithm 5.7 given q and the list of defect-d elliptic curves over F g as input. 
Suppose that the exponent of the class group of Ao is greater than 2. Then S 
contains all genus-2 curves C over F q such that the Jacobian of C is isomorphic 
(as an unpolarized abelian surface) to the square of an elliptic curve with defect d 
and with CM by Ao- 

Note that there are at most 66 negative fundamental discriminants whose class 
groups have exponent at most 2, and there are exactly 65 such discriminants if the 
GRH is true, the largest in absolute value being —5460 [39, Theorem 1, p. 119]. A 
list of these 65 discriminants is given in [3, Table 5.1, p. 426]. 

Proof of Theorem 5.8. Recall that a Richelot isogeny from a genus-2 curve C is ob¬ 
tained by taking a subgroup-scheme G of (JacC)[2] that is maximal isotropic with 
respect to the Weil pairing and observing that the quotient variety A = (Jac C)/G 
has a natural principal polarization A such that the pullback of A to Jac C is twice 
the canonical principal polarization on Jac C. When the principally-polarized sur¬ 
face (A, A) is the Jacobian of a curve D, we say that we have a Richelot isogeny 
from C to D (or from JacC to JacU). But (A, A) might also not be a Jacobian; 
it might be the product of two elliptic curves with the product polarization. 2 This 
is precisely the situation discussed in [19, §3]. One could continue to say (A, A) is 
the Jacobian of a curve — the singular genus-2 curve consisting of the union of 
the two elliptic curves, crossing transversely at their origins. We will use the term 
“generalized Richelot isogeny” to refer to this slightly expanded concept; however, 
we should keep in mind that Algorithm 5.7 refers only to Richelot isogenies between 
nonsingular genus-2 curves. 

Let O be the imaginary quadratic order of discriminant Ao- We note that 
A = 5 mod 8, so we also have Ao = 5 mod 8, so that 2 is inert in O, and the 
only simple 0-module of 2-power order is 0/20. Let £ be an elliptic curve with 
trace t and with CM by O. The elliptic curves isogenous to E with CM by O 
form a principal homogeneous space for the class group CIO of 0; we choose E to 
be a base point for the action of the class group. Finitely generated torsion-free 
0-modules are determined by their rank and their Steinitz class; as a consequence, 
if Ei, Ei, £ 3 , and £4 are elliptic curves corresponding to elements g\, < 72 , 93, and 
<74 of C10, then the surfaces Ei x £2 and £3 x £4 are isomorphic if and only if 
<71 + <72 = 93 + 94 - If A is an abelian surface isogenous to £ x £ with Frobenius 
endomorphism 7 r such that Q(7r) flEnd A = 0, then A is isomorphic to £1 x £2 for 
two elliptic curves with CM by 0, which themselves correspond as above to two 
clement g± and <72 of the class group C10; the Steinitz class of A (with respect to 
the base point £) is the element g 1 + 52 of C10. 

Let g be an clement of C10 that is not 2-torsion, and let £1 and £2 be the 
elliptic curves corresponding to g and to —g, so that £1 and £2 are not isomorphic 
to one another. Let P\ £ £i[2](F g ) and P 2 £ £2[2](F g ) be generators for the 
simple 0-modules £i[2](F g ) and £2[2](F g ), and let ip: £i[2](F g ) -A- £2[2](F g ) be 

2 A priori, it might also be the Weil restriction of a polarized elliptic curve over F (/ 2 [11, 
Theorem 3.1, p. 270], but no such Weil restriction is isogenous to the square of an elliptic curve 
with nonzero trace. 



16 


EVERETT W. HOWE 


the unique 0-module isomorphism that sends P\ to P 2 . Then the construction 
of [19, Proposition 4, p. 324], applied to £ 1 , £ 2 , and ip, will produce a genus-2 
curve C whose Jacobian J is isomorphic to E\ x £2 divided by the graph X of ip. 
The ring 0 acts on X , so 0 acts on J compatibly with Frobenius, so J has a Steinitz 
class. The class of the 0-module X in the class group is trivial, so the Steinitz class 
of J is equal to that of £1 x £ 2 , which is trivial; therefore J is isomorphic to £ 2 . 
The curve C is included in the output of Algorithm 5.1 of [5], applied to £1 and £ 2 . 
This shows that after step 2, the set S from Algorithm 5.7 includes at least one 
curve C whose Jacobian is isomorphic (as an unpolarized surface) to £ 2 . Let D 
be any other curve over F g whose Jacobian is isomorphic to £ 2 . We will show 
that there is a sequence of generalized Rlchelot isogenies starting from Jac0 and 
ending at Jac£. To prove this, we will work with the category PoCs £ 2 discussed 
in Section 4. 

The quaternion algebra H associated in Section 4 to Pols £ 2 is the quaternion 
algebra over Q ramified at 00 and at the prime divisors of Ao that are congruent 
to 3 modulo 4, and the order 0[i\ of H defined in Section 4 has discriminant equal 
to the squarefree integer Ao- It follows from [1, Proposition 1.54, p. 12] that 0[i\ 
is an Eichler order in H of level equal to the product of the prime divisors of Ao 
that are congruent to 1 modulo 4. 

Let L and M be principal polarizations on £ 2 such that (£ 2 ,L) and (£ 2 ,M) 
are isomorphic to JacC and Jac£ as principally-polarized surfaces, and let I and 
J be the right ideal classes of G[i] corresponding to L and M under the equivalence 
of categories described in Section 4. We claim that there is an element a of H such 
that al C J and such that the index of al in J is a power of 2. To see this, we 
use the following result, found in the section of [33] devoted to applications of the 
strong approximation theorem (paraphrased here with slightly different notation): 

Let H be a definite quaternion algebra over a totally real field £ 
with ring of integers R, and let O be an i?-order in H such that 
for all finite primes p of R, the local norm maps Op —> i?p are 
surjective. Suppose the narrow class group of R is trivial, and let 
p be a prime of R which is unramified in H. Then every ideal class 
of O contains an integral O-ideal whose reduced norm is a power 
of p. 

Our order 0 [z] is an Eichler order, so the condition on the local norm maps is 
satisfied for all primes p of Z. Also, 2 is unramified in H. 

The ideal J is invertible because the order 0[i\ is hereditary (because its reduced 
discriminant is squarefree). Consider the right order O of the lattice /J -1 ; it is 
locally isomorphic to 0[i\ at every prime, so it also satisfies the condition on norm 
maps given above. Applying the quoted result with p = 2, we find that there is an 
a £ H such that a!J~ x is an integral ideal of norm 2* for some i > 0. In particular, 
al C J, and the index of al in J is a power of 2. 

Translating this back into the category PoCs E 2 , we find that there is a £ £ 
Hom(L, M) of determinant 2* such that 

P*MP = (detP)L. 

In terms of abelian surfaces, this means that we have an isogeny ip of degree 2* 
from JacC to Jac£ such that the pullback <p*M of the principal polarization on 
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JacD is equal to 2* times the polarization L. We will show that p can be written 
as a composition of generalized Richelot isogenies. 

We note that the kernel of p is a maximal isotropic subgroup of the 2*-torsion of 
Jac C. Now there are two possibilities: Either (ker<p)n(JacC')[2] is all of (JacC)[2], 
or it is an order-4 subgroup. 

Suppose (kery:) n (JacC)[2] = (JacC)[2]. Note that (JacC)[2](F q ) is a vector 
space over k := 0/20 = F 4 , and the Weil pairing on (Jac (7)[2] is semi-balanced 
with respect to this action of k\ that is, we have e 2 (aP,Q) = e 2 (P,aQ) for every 
P, Q € (JacC)[2](F q ) and a € k, where a is the conjugate of a over F 2 . Then [15, 
Lemma 7.3, p. 2378] shows that there is a one-dimensional isotropic fc-subspace G 
of (JacC)[2], The group G is a maximal isotropic subgroup of (Jac C) [2], so we 
obtain a generalized Richelot isogeny whose kernel is contained in the kernel of p. 
In other words, p factors through a generalized Richelot isogeny. 

On the other hand, suppose (ker y>) 0 (JacC)[2] has order 4. Then (ker y>)(F g ) is 
isomorphic as an abelian group to Z/2*Z x Z/2*Z. Let P and Q be generators of 
(ker<^)(Fg). Since harp is an isotropic subgroup of (JacC)[ 2 *], we have e 2 i(P, Q) = 
1, where e 2 * is the Weil pairing on (JacC)[2 z ]. From the compatibility of the Weil 
pairing, it follows that e 2 ( 2 * _ 1 P, 2 l ~ 1 Q) = 1. Let G = (kery>) 0 (Jac (7) [2], so that 
G(F g ) is generated by 2 l ~ 1 P and 2 l ~ 1 Q. We see that G is a maximal isotropic 
subgroup of (JacC)[2], and arguing as in the preceding paragraph, we find that p 
factors through a generalized Richelot isogeny. 

In either case, p factors through a generalized Richelot isogeny. Repeating this 
argument, we find that p is in fact a composition of generalized Richelot isogenies. 

This almost, but not quite, shows that after Step 4 the set S from Algorithm 5.7 
contains all curves whose Jacobians are isomorphic (as unpolarized surfaces) to E 2 . 
The lacuna in the argument is that the sequence of generalized Richelot isogenies 
from (E 2 ,L) to (P 2 ,M) may pass through singular curves, as discussed above. 
Suppose this is the case, and consider the split polarized surface E\ x P 2 closest 
to (E 2 , M) along the given path of generalized Richelot isogenies. The first surface 
after E± x E 2 will be a genus-2 curve obtained via the Howe-Leprevost-Poonen 
construction [19, Proposition 4, p. 324], and so will appear in the set S after step 2. 
The path of generalized Richelot isogenies from E\ x E 2 to (E 2 , M) does not contain 
any further split polarized surfaces, so by the end of step 4, the set S constructed 
by Algorithm 5.7 will contain ( E 2 ,M ). □ 

Remark 5.9. In practice it can be helpful to modify Step 2(a) of Algorithm 5.7. 
In addition seeding the list S with curves whose Jacobians are (2, 2)-isogenous to 
products of two elliptic curves of defect d , we can also throw in curves whose Jaco¬ 
bians are (3,3)-isogenous to a product of such elliptic curves, by using Algorithm 5.4 
(p. 185) of [5], 

Heuristic Expectation 5.10. Fix d > 0. As q varies over the odd prime powers, 
Algorithm 5.7, applied to q and the list of trace-d elliptic curves over E q , runs 
in time O (q 3 ^ 4 ). Furthermore, if d > 0 and q is d-unexceptional, the algorithm 
produces q 3 / 4 curves, up to logarithmic factors. 

Justification. For a fixed d , Heuristic 5.6 suggests that the number of curves pro¬ 
duced by the algorithm is bounded above by q 3 / 4 , up to logarithmic factors. When 
d > 0 and q is d-unexceptional, we expect the number of curves is bounded below 
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by a similar expression. The time taken by the algorithm is the size of its output, 
times factors of log q. □ 

6. Genus-4 curves with small defect 

In this section we present our algorithm for producing genus-4 curves with small 
defect. 

Algorithm 6.1. 

Input: An odd prime power q = p e . 

Output: A genus-4 curve over F g , or the word “failure”. 

1. Compute m = [2 yjq\ , set d = 0, and set £ = {}. 

2. Set t = d — to. If p \ t, then skip to Step 10. 

3. Set A = t 2 — Aq and write A = AqF 2 for a fundamental discriminant Ao- 

4. Using the algorithm of [32], compute the mod-g reductions of the Hilbert class 
polynomials of discriminant Ao / 2 for all divisors / of F. 

5. Compute the roots in F g of these Hilbert class polynomials. 

6 . Compute representatives of all of the isomorphism classes of elliptic curves whose 
/-invariants are among these roots, and let £d be the subset of those elliptic 
curves whose defect is d. 

7. Add the elements of £d to the set C. 

8 . Run Algorithm 5.7 with inputs q and C. 

9. For each curve C in the output of Algorithm 5.7: 

(a) Write C as y 2 = f for a sextic polynomial /. 

(b) For each factorization of / into a pair /i, /2 of cubics (up to order and up 

to scaling by squares in F g ), run Algorithm 2.7 on q, /i, £i, and £ 2 , 

where each is the set of curves in £ that are compatible with fi. 

(c) If Algorithm 2.7 outputs an element a € P 1 (F g ), output the curve D a (fi, f 2 ) 
from Section 2 and stop. 

10. Increment d. If d > to, output “failure” and stop. Otherwise, go to step 2. 

Remark 6.2. In Step 2 we avoid the case p \ t solely to make the analysis of the 
algorithm simpler. In actual practice, we will encounter the case p \ t most often 
when q is a square and d = 0. In this case, we should simply compute the set £d of 
(supersingular) elliptic curves of defect 0 in any of a number of ways — by using the 
formulas from [21], for example, or by using the algorithm of Broker [4] to compute 
one such curve and then computing the graph of 2 -isogenies — and then continue 
with Step 7. 

Heuristic Expectation 6.3. For large odd 1-unexceptional prime powers q, Al¬ 
gorithm 6.1 will output a curve of defect at most 4 in time 0(g 3//4 ). 

The justification of this heuristic expectation depends on knowing something 
about the Galois structure of the Weierstrass points of the genus-2 curves produced 
by Algorithm 5.7; we need to know that some fraction of these curves can be used 
in Algorithm 2.7. Proposition 6.4 below gives us the information we need. Let us 
begin by setting up the notation for the proposition. 

Let E be an ordinary elliptic curve over a finite field F g of odd characteristic 
and let it be the Frobenius endomorphism of E. Let R be the subring Z [ 7 r] of 
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EndE. From [7] we know that the abelian surfaces isogenous to E 2 are in bijection 
with the torsion-free i?-modules of rank 2, and results of Borevic and Faddeev [2] 
(summarized in [22, Theorem 48, p. 326]) classify such R- modules. Pushing this 
classification back through Deligne’s result, we find the following: Every abelian 
surface A isogenous to E 2 can be written as E\ x E 2 for two elliptic curves with 
End Ei D EndE 2 ; if A can also be written E[ x E' 2 where EndE[ D End E 2 , then 
EndE[ = End Ei and End E 2 = EndE 2 ; and, given any elliptic curve E[ with 
End E[ = End E\ , there is a unique E 2 such that A = E[ x E 2 . 

Suppose A is isogenous to E 2 , and write A = E\ x E 2 as above. Note that the 
conductor of the quadratic order EndEi divides that of EndE 2 ; it follows that 
the dimension d\ of the F 2 -vector space Ei[2](F g ) is greater than or equal to the 
dimension g ?2 of E 2 [ 2 ](F g ). Also, since Ei(F q ) has even order if and only if E 2 (F 9 ) 
has even order, we have d\ = 0 if and only if e ?2 = 0 . 

Proposition 6.4. With notation as above, letC be the isogeny class of E and let S 
be the set of genus-2 curves overF q whose Jacobians are isomorphic (as unpolarized 
surfaces ) to A. 

(1) If (di,d 2 ) = (0,0), then every curve in S can be written in the form y 2 = 
/ 1/2 for irreducible cubic polynomials /i ,/2 £ F g [a;], an d every curve in C 
is compatible with both fi and / 2 - 

(2) If (d±,d 2 ) = (2,2), then every curve in S can be written in the form y 2 = 
/ 1/2 for cubic polynomials /i ,/2 £ F g [x] that are completely split, and at 
least 1/4 of the curves in C are compatible with both fi and f 2 ■ 

(3) If (di, c? 2 ) = (2,1), then every curve in S can be written in the form y 2 = 
/ 1/2 for cubic polynomials /i ,/ 2 £ F g [x], where fi has only one root and 
f 2 is completely split ; at least 1/2 of the curves inC are compatible with f\, 
and at least 1/4 are compatible with f 2 - 

(4) Suppose (di,d 2 ) = (1,1). If C is a curve in S, then C can either be 
written in the form y 2 = / 1 / 2/3 for three irreducible quadratic polynomials 
/i,/ 2,/3 £ F 5 [x], or in the form y 2 = / 1 / 2 , where f\ and f 2 are cubic 
polynomials, each with exactly one root. At least 1/4 of the curves in S are 
of the latter type; and, for these curves, at least 1/2 of the curves in C are 
compatible with both fi and f 2 - 

Proof. We note for future reference that if the curves in C have even group orders, 
then the theory of isogeny volcanoes shows that either no curves in C have 2-rank 
equal to 2, or at least 1/4 of them do. Similarly, at least 1/2 of the curves in C 
have 2 -rank equal to 1 . 

Suppose C is a curve in S. The six Weierstrass points of C fall into orbits under 
the action of the absolute Galois group of F q , and the orbit structure determines 
the ranks of the 2-torsion subgroup of Jac C over the extensions of F g . These ranks 
are also determined by the pair (di,^). Comparing these ranks (for the first three 
extensions of F q ) for the various possible Galois structures and the various possible 
pairs (di,d 2 ), we find the following: 

The only Galois orbit structure compatible with (di, tfe) = (0, 0) is for the Weier¬ 
strass points to be divided into two orbits of size 3; this translates into C being of 
the form y 2 = / 1/2 for two irreducible cubics fi and / 2 - The curves in C have no 
rational points of order 2, so /1 and /2 are compatible with all of the curves in C. 

Similarly, the only Galois orbit structure that is compatible with (di, cfe) = (2,2) 
is six orbits of size 1; this means that C can be written (in several ways) as y 2 = 
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/ 1 / 2 , for two completely split cubics /1 and / 2 - Since E\ and E2 both have 2-rank 
equal to 2, we see that at least 1/4 of the curves in C have 2-rank equal to 2, and 
each such curve is compatible with both /1 and fi- 

The only Galois orbit structure compatible with (di,^) = (2,1) is one orbit of 
size 2 and four of size 1; this means that C can be written (in several ways) as 
y 2 = / 1 / 2 , where /1 is a cubic with only one root and is a completely split cubic. 
At least 1/2 of the curves in C have 2-rank equal to 1 and are compatible with / 1 ; 
and, since E 1 has 2-rank equal to 2, at least 1/4 of the curves in C have 2-rank 
equal to 2 and are compatible with / 2 . 

We are left to consider the case (d\ , d.2) = (1,1). There are two Galois orbit 
structures compatible with these values of d\ and d2'. three orbits of size 2, or two 
orbits of size 2 and two of size 1. To analyze this case, we consider a graph G 
constructed as follows. 

We let the vertices of G be the isomorphism classes of principal polarizations 
on A. Given two principal polarizations A and p, we connect the associated vertices 
with an edge if and only if there is a diagram 


( 2 ) 



Each edge from a vertex A gives rise to a Galois-stable subgroup of A[2](F g ) that 
is maximal isotropic with respect to the Weil pairing associated to A — namely, 
ker 

Let us call a polarization A of A bad if the polarized variety (A, A) is isomorphic 
to the Jacobian of a curve C whose Weierstrass points form three Galois orbits of 
size 2; good if the polarized variety (A, A) is isomorphic to the Jacobian of a curve C 
whose Weierstrass points form two Galois orbits of size 2 and two of size 1; and split 
if the polarized variety (A, A) is isomorphic to the product of two elliptic curves 
with the corresponding product polarization. We will show that in the graph G, 
every bad vertex is adjacent to at least one good vertex, and every good vertex is 
connected to at most three bad vertices. From this it follows that there are at most 
three times as many bad polarizations as good ones, and therefore at least 1/4 of 
the curves in S can be written y 2 = / 1/2 for cubics /1 and / 2 , each with exactly 
one root. 

Any morphism from A to its dual variety that is equal to its own dual morphism 
can be represented by a 2 x 2 array 



where k and £ are integers, a is a homomorphism from E\ to E 2 , and a is the 
dual morphism from E2 to E\. Such an array gives an endomorphism of E\ x E2] 
composed with the product polarization from E± x E 2 to its dual, this endomorphism 
gives a polarization if k, £, and k£— deg a are all positive, and a principal polarization 
if k£ — deg a = 1. 

We will show that a polarization is bad if and only if the array associated to it has 
k and £ both even. To do this, we will count the number of Galois-stable subgroups 
of A[2](F 9 ) that are maximal isotropic subgroups with respect to the Weil pairing 
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induced by the polarization. First we count the number of such subgroups for 
good, bad, and split curves, and then we count these subgroups for polarizations 
of A given by arrays as above. 

Suppose A is a bad polarization, corresponding to a curve C. The Galois-stable 
maximal isotropic subgroups of (JacG)[2](F 9 ) correspond to Galois-stable parti¬ 
tions of the six Weierstrass points of C into three disjoint subsets of size two. For 
a bad curve, it is easy to check that there are seven such partitions. 

Similarly, if A is a good polarization, we find that there are exactly three Galois- 
stable maximal isotropic subgroups of the 2-torsion. If A is a split polarization, 
then again there are exactly three such subgroups. This shows that good curves 
and split curves are connected to at most three other vertices in the graph G, and 
in particular are connected to at most three bad vertices. 

Now let us count the Galois-stable subgroups of A[2](F g ) that are maximal 
isotropic with respect to the Weil pairing obtained from a polarization described 
by an array as above. First we simply count the Galois-stable subgroups of order 
four, without the isotropy condition. 

For each i let Pi be the rational 2-torsion point of Ei and let Qi be a non-rational 
2-torsion point of Ei. Note that A[2](F q ) contains exactly seven Galois-stable 
subgroups of order 4, namely: 


(3) ((Pi, 0),(Q l7 0)}, ((0,P 2 ),(0,Q 1 )}, 

((P 1 ,0),(Q 1 ,P 2 )), ((0,P 2 ),(P 1 ,Q 2 )), <(Pi,P 2 ),(Qi,Q 2 )>, 

((Pi, P 2 ), (Q 1 ,Q 2 + P 2 )}, ((Pi, 0), (0, P 2 )}. 


We check that all seven of these subgroups are isotropic with respect to the Weil 
pairing on the 2-torsion associated to a polarization A if and only if the array L 
associated to A has k and i both even. Thus, the bad polarizations are precisely 
the polarization that can be represented by endomorphisms 


L = 


k 

a 


a 

d 


such that both k and d are even. 

Suppose A is bad, represented by an L as above with k and d. even. First, 
we will show that there is a polarization isomorphic to A whose associated L has 
k = 2 mod 4 or d = 2 mod 4. 

Certainly if k = 2 mod 4 or £ = 2 mod 4 we are done, so assume that both k and 
l are divisible by 4. Since kd — deg a = 1, we see that deg a is odd. Consider the 
automorphism 


P = 


of A. Pulling back A via P replaces L with 




1 —a 

0 1 

k a 
a d 

' 1 O' 

—a 1 


k + (£ - 

2 )aa 

(1 - d)a' 


(1 -d)a 

d 


Since aa = deg a is odd and k and d are divisible by 4, the upper left entry in this 
new array is congruent to 2 modulo 4. Thus, if a polarization is bad, it is isomorphic 
to a bad polarization A for which either k or d is congruent to 2 modulo 4. 
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Suppose A is a bad polarization with k = 2 mod 4. Consider the polarization /i 
we obtain by taking in diagram (2) to have kernel equal to the first group in (3); 
that is, we take <f> to be [q ?]■ We compute that y is given by the endomorphism 


M = 


k/2 

a 


a 

2 £ ’ 


whose upper left entry is odd, so y is either good or split. Likewise, if £ = 2 mod 4, 
we can take $ in diagram (2) to have kernel equal to the second group in (3); that 
is, we take $ to be [J §]. Then y is given by the endomorphism 



a 


a 

£/2 


whose lower right entry is odd, so y is either good or split. This shows that in the 
graph G, every bad vertex is connected to at least one vertex that is good or split. 
To complete our argument, we need only show that bad vertices cannot be adjacent 
to split vertices. 

If y is a split polarization, then the polarized variety ( A , y) is isomorphic to a 
product surface Fj x F 2 with the product polarization, and both Fj and F 2 have 
2-rank equal to 1. If /z, is connected to a good or a bad polarization, corresponding 
to a curve G, then G is obtained from Fj and F 2 using the Howe-Leprevost-Poonen 
construction [19, Proposition 4]. Since Fj and F 2 have rank 1, they have models of 
the form 


Fj: y 2 = (x 2 - n)(a!X - 61 ) F 2 : y 2 = (x 2 - n)(a 2 x - b 2 ), 

where n is a nonsquare in F g . One computes that the curves obtained from Fj and 
F 2 using the formulas of [19, Proposition 4] are of the form y 2 = h , where h is a 
sextic polynomial having 1 and —1 as roots. Thus, the vertices adjacent to a split 
vertex are either split or good. In particular, a bad vertex is never adjacent to a 
split vertex. □ 


Justification of Heuristic Expectation 6.3. Take d = 1. We already noted that, 
under the GRH, the number of defect-1 elliptic curves over F g for 1-unexceptional q 
grows like q 1 / 4 , up to logarithmic factors, and Heuristic Expectation 5.10 tells us to 
expect the number of genus-2 curves over F g of defect 2 produced by Algorithm 5.7 
to grow like q 3 / 4 , up to logarithmic factors. Proposition 6.4 tells us that at least 
1/4 of the curves produced by the algorithm can be written as y 2 = / 1/2 for cubic 
polynomials _/j and that are each compatible with at least 1/4 of the defect-1 
elliptic curves over F r; . 

For each genus-2 curve G in Step 9, we expect Algorithm 2.7 to succeed with 
probability on the order of q~ 1 ' 2 , so we expect to have to apply Step 8 to about 
g 1 / 2 curves G before we succeed. Each application of Algorithm 2.7 takes time 
(/(q 1 / 4 ), so the total time to success should be 0 (<? 3 / 4 ). □ 


7. Results 

We implemented our algorithms in Magma, and we ran Algorithm 6.1 on all of 
the odd prime powers less than 100,000. (This took a few days, running in the 
background on a modest laptop computer.) There are 9684 such prime powers q , 
four of which — 3 3 , 3 5 , 3 9 , and 5 5 — are 1 -exceptional in the sense defined in 
Section 5. The genus-4 curves produced by the algorithm had 
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• defect 0 for 3027 of these q (~ 31.3%), 

• defect 2 for 2268 of these q (~ 23.4%), 

• defect 4 for 4054 of these q (~ 41.9%), 

• defect 6 for 330 of these q (~ 3.4%), and 

• defect 8 for 5 of these q (« 0.05%). 

The five q for which the best curve we found had defect 8 are the primes 
154 2 + 3, 160 2 + 160 + 3, 221 2 + 16, 282 2 + 282 + 5, and 307 2 + 4. 

We maintain our conviction that for large enough 1-unexceptional q , our algo¬ 
rithm will find a curve of defect 4 or less — but q may have to be large indeed, 
because even though we expect the number of genus-2 defect-2 curves to grow 
like q 3 / 4 , the implied constant is fairly small. 
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